CVE-2017-14652

Critical

Published: 21/09/2017(UTC)Translated: 14/06/2026(UTC)NVD NIST

Summary

The Tapatalk plugin before version 4.5.8 for MyBB contains an SQL injection vulnerability in mobiquo/lib/classTTForum.php, allowing an unauthenticated remote attacker to inject arbitrary SQL commands via an XML-RPC encoded document sent during the user registration process.

Risk Assessment

This vulnerability could lead to unauthorized access to the database, posing a serious threat to the integrity and confidentiality of the organization's data.

Recommendation

It is recommended to update the Tapatalk plugin to version 4.5.8 or later to mitigate this vulnerability and conduct a security audit of the application.

Original NVD description (English source)

SQL Injection vulnerability in mobiquo/lib/classTTForum.php in the Tapatalk plugin before 4.5.8 for MyBB allows an unauthenticated remote attacker to inject arbitrary SQL commands via an XML-RPC encoded document sent as part of the user registration process.